1
1
00:00:00,300 --> 00:00:02,640
Configuring a SIEM agent.
2
2
00:00:02,640 --> 00:00:05,160
In this lesson, I'm going to go into my lab environment
3
3
00:00:05,160 --> 00:00:06,420
and show you how to configure
4
4
00:00:06,420 --> 00:00:09,570
a security information and event management system.
5
5
00:00:09,570 --> 00:00:10,500
Now, we're going to make sure
6
6
00:00:10,500 --> 00:00:13,500
that we get the agents on the systems in our network
7
7
00:00:13,500 --> 00:00:15,660
configured so they can report back to that SIEM
8
8
00:00:15,660 --> 00:00:18,270
so we can use that for later analysis.
9
9
00:00:18,270 --> 00:00:20,730
Now, in this lesson, I'm going to use Security Onion,
10
10
00:00:20,730 --> 00:00:23,010
which is an appliance that comes as a VM,
11
11
00:00:23,010 --> 00:00:26,010
and it implements things like Elastic Stack, Kibana
12
12
00:00:26,010 --> 00:00:28,080
and other SIEM functionalities within it.
13
13
00:00:28,080 --> 00:00:29,490
Now, the first thing we're going to do
14
14
00:00:29,490 --> 00:00:32,520
is we're going to go and configure our sensor.
15
15
00:00:32,520 --> 00:00:34,380
Now, I've already done this for us,
16
16
00:00:34,380 --> 00:00:36,900
but if you look on the right side of this diagram,
17
17
00:00:36,900 --> 00:00:39,780
you're going to see the unified threat management system
18
18
00:00:39,780 --> 00:00:41,280
up at the top.
19
19
00:00:41,280 --> 00:00:44,400
On that, we have a connection going to vLOCAL,
20
20
00:00:44,400 --> 00:00:48,690
and vLOCAL has a sensor feeding data into my SIEM.
21
21
00:00:48,690 --> 00:00:49,740
Now, in addition to that,
22
22
00:00:49,740 --> 00:00:51,390
I'm also going to be collecting information
23
23
00:00:51,390 --> 00:00:54,396
from the Windows virtual machines down in the bottom,
24
24
00:00:54,396 --> 00:00:56,310
MS1 and DC1.
25
25
00:00:56,310 --> 00:00:59,340
Both of those have data that's being fed up into vLOCAL,
26
26
00:00:59,340 --> 00:01:00,660
and using that sensor port,
27
27
00:01:00,660 --> 00:01:01,950
I'm going to collect that information,
28
28
00:01:01,950 --> 00:01:03,690
and send it to my SIEM.
29
29
00:01:03,690 --> 00:01:04,523
All right.
30
30
00:01:04,523 --> 00:01:06,720
So the next thing I want to do is go into my SIEM,
31
31
00:01:06,720 --> 00:01:08,310
and we're going to open a terminal,
32
32
00:01:08,310 --> 00:01:09,270
and from within here,
33
33
00:01:09,270 --> 00:01:12,090
we're going to start dumping that information from the network
34
34
00:01:12,090 --> 00:01:14,310
that we're capturing over that sensor wire.
35
35
00:01:14,310 --> 00:01:18,907
So I'm going to type in sudo tcpdump -ni eth1 ip and hit enter.
36
36
00:01:21,750 --> 00:01:23,820
Using the -n switch is going to tell us
37
37
00:01:23,820 --> 00:01:25,500
that we don't want to use name resolution
38
38
00:01:25,500 --> 00:01:27,450
because I'm not connected to the internet
39
39
00:01:27,450 --> 00:01:29,550
so I can't look up things like google.com.
40
40
00:01:29,550 --> 00:01:31,380
I have to use IP addresses.
41
41
00:01:31,380 --> 00:01:33,330
And by using the IP at the end,
42
42
00:01:33,330 --> 00:01:36,240
this is going to filter out any IPv6 traffic.
43
43
00:01:36,240 --> 00:01:39,210
So I'm just going to be focused on IPv4 traffic.
44
44
00:01:39,210 --> 00:01:41,640
This will make sure that I see things for traffic going to
45
45
00:01:41,640 --> 00:01:44,400
and from my host in those two Windows machines
46
46
00:01:44,400 --> 00:01:47,160
and to that unified threat management system.
47
47
00:01:47,160 --> 00:01:48,780
All right, once I'm done capturing this,
48
48
00:01:48,780 --> 00:01:50,220
I'm going to hit Control + Z
49
49
00:01:50,220 --> 00:01:52,710
and that will stop this traffic capture.
50
50
00:01:52,710 --> 00:01:56,160
Now, this traffic is going to be monitored by Bro.
51
51
00:01:56,160 --> 00:01:59,190
Bro is a passive network sensor that we're going to use.
52
52
00:01:59,190 --> 00:02:01,590
Basically, it's an intrusion detection system.
53
53
00:02:01,590 --> 00:02:04,200
It's part of that unified threat manager.
54
54
00:02:04,200 --> 00:02:06,000
Now, those events have already been configured
55
55
00:02:06,000 --> 00:02:08,100
so it's going to write into the SIEM.
56
56
00:02:08,100 --> 00:02:10,260
The SIEM is going to allow me to see what's in there
57
57
00:02:10,260 --> 00:02:13,110
and we're going to use Elastic Stack to do that.
58
58
00:02:13,110 --> 00:02:14,160
So if I go ahead
59
59
00:02:14,160 --> 00:02:17,220
and see if Elastic Stack is running properly, I can do this
60
60
00:02:17,220 --> 00:02:22,220
by typing in sudo space so-status and hit enter.
61
61
00:02:22,710 --> 00:02:24,060
This will give me the output that shows
62
62
00:02:24,060 --> 00:02:26,160
that each service is up and okay.
63
63
00:02:26,160 --> 00:02:27,930
If I get some kind of a warning message
64
64
00:02:27,930 --> 00:02:30,510
that means one of the things that I'm using to collect this,
65
65
00:02:30,510 --> 00:02:32,190
things like logstash, which is part
66
66
00:02:32,190 --> 00:02:34,560
of Elastic Stack might not be quite ready yet
67
67
00:02:34,560 --> 00:02:38,040
so I would have to wait and then run that status again.
68
68
00:02:38,040 --> 00:02:40,080
All right, from my desktop, I'm going to go ahead
69
69
00:02:40,080 --> 00:02:41,700
and open up Kibana.
70
70
00:02:41,700 --> 00:02:43,980
Inside of Kibana, I'm going to log in with my username
71
71
00:02:43,980 --> 00:02:47,190
and password and this is going to bring me to a dashboard.
72
72
00:02:47,190 --> 00:02:48,930
Kibana is a virtualization tool
73
73
00:02:48,930 --> 00:02:51,030
and it's part of Elastic Stack.
74
74
00:02:51,030 --> 00:02:52,920
It's going to be used to configure the dashboards
75
75
00:02:52,920 --> 00:02:55,320
for different categories, showing us different information
76
76
00:02:55,320 --> 00:02:57,930
in a graph format or a table format.
77
77
00:02:57,930 --> 00:02:59,790
Now, if I go down under Bro Hunting,
78
78
00:02:59,790 --> 00:03:01,440
I can select connections
79
79
00:03:01,440 --> 00:03:04,260
and from here I can scroll down to verify that the host
80
80
00:03:04,260 --> 00:03:08,280
from the 10.1.0.0/24 network are present
81
81
00:03:08,280 --> 00:03:09,780
and accounted for.
82
82
00:03:09,780 --> 00:03:10,613
This will make sure
83
83
00:03:10,613 --> 00:03:12,090
that I'm seeing the information being sent
84
84
00:03:12,090 --> 00:03:14,340
to me by my intrusion detection system.
85
85
00:03:14,340 --> 00:03:15,173
All right, now
86
86
00:03:15,173 --> 00:03:17,113
that we see the Kibana is properly configured,
87
87
00:03:17,113 --> 00:03:19,860
I want to start doing some scans and make sure
88
88
00:03:19,860 --> 00:03:23,280
that Kibana is seeing this inside of there with live data.
89
89
00:03:23,280 --> 00:03:26,250
So I'm going to go into Zenmap, which is on my Windows machine
90
90
00:03:26,250 --> 00:03:29,490
and I'm going to run a scan using a default intent scan
91
91
00:03:29,490 --> 00:03:32,460
against 10.1.0.1.
92
92
00:03:32,460 --> 00:03:35,670
Now, Zenmap is essentially just a graphical version of Nmap,
93
93
00:03:35,670 --> 00:03:37,230
which is a network scanner.
94
94
00:03:37,230 --> 00:03:39,480
So it's going to go through and perform the scan for me.
95
95
00:03:39,480 --> 00:03:41,850
And now I'm going to go back into Kibana.
96
96
00:03:41,850 --> 00:03:43,920
If I go there under alert data,
97
97
00:03:43,920 --> 00:03:45,870
I can then view the Bro notices
98
98
00:03:45,870 --> 00:03:49,110
and NIDS categorization for scanning activity alerts.
99
99
00:03:49,110 --> 00:03:50,580
Now, if there are no results,
100
100
00:03:50,580 --> 00:03:52,680
you want to click on the update button.
101
101
00:03:52,680 --> 00:03:55,440
Now, as we do this, we should be detecting that scan
102
102
00:03:55,440 --> 00:03:57,807
that the Windows machine is doing against this network
103
103
00:03:57,807 --> 00:04:00,990
and Kibana as the SIEM is seeing all that data
104
104
00:04:00,990 --> 00:04:03,150
because we have that port mirroring enabled
105
105
00:04:03,150 --> 00:04:04,620
off of that switch.
106
106
00:04:04,620 --> 00:04:05,910
Now, as you can see here,
107
107
00:04:05,910 --> 00:04:09,240
the NIDS alerts are being counted and we can see those scans
108
108
00:04:09,240 --> 00:04:13,020
because we have this scan being run by our Zenmap.
109
109
00:04:13,020 --> 00:04:15,660
So this is telling me this process is working
110
110
00:04:15,660 --> 00:04:18,420
and we're able to see it in real time.
111
111
00:04:18,420 --> 00:04:19,800
Now, the next thing we want to look at
112
112
00:04:19,800 --> 00:04:21,840
is how to install a Beats agent
113
113
00:04:21,840 --> 00:04:23,790
so we can capture network traffic directly
114
114
00:04:23,790 --> 00:04:26,130
from the host instead of just capturing things
115
115
00:04:26,130 --> 00:04:28,410
off of the network switch using port mirroring
116
116
00:04:28,410 --> 00:04:30,450
like we were doing up to this point.
117
117
00:04:30,450 --> 00:04:32,790
To do this, we want to capture that log information.
118
118
00:04:32,790 --> 00:04:34,830
So we're going to install the Beats agent.
119
119
00:04:34,830 --> 00:04:37,710
So let me go ahead and log into my DC1
120
120
00:04:37,710 --> 00:04:39,750
and from here I want to configure Beats
121
121
00:04:39,750 --> 00:04:41,730
and I do that by going under my lab files.
122
122
00:04:41,730 --> 00:04:43,710
And then win logbeat.
123
123
00:04:43,710 --> 00:04:46,380
In here, you'll see winlogbeat.yml
124
124
00:04:46,380 --> 00:04:47,940
which is the configuration file
125
125
00:04:47,940 --> 00:04:49,110
and I'm going to right click it
126
126
00:04:49,110 --> 00:04:51,810
and edit it with Notepad++.
127
127
00:04:51,810 --> 00:04:53,760
Now, as I edit this file, you have to remember
128
128
00:04:53,760 --> 00:04:56,700
that YAML files are very sensitive to white space.
129
129
00:04:56,700 --> 00:04:59,670
So every space is actually used and counted.
130
130
00:04:59,670 --> 00:05:02,160
So you can't just add spaces willy-nilly,
131
131
00:05:02,160 --> 00:05:04,200
you got to make sure you count correctly.
132
132
00:05:04,200 --> 00:05:07,770
These files use two spaces per indentation level
133
133
00:05:07,770 --> 00:05:11,550
so if you want to use two, that would be the first column.
134
134
00:05:11,550 --> 00:05:12,383
Two more.
135
135
00:05:12,383 --> 00:05:13,380
That gives you four spaces,
136
136
00:05:13,380 --> 00:05:16,440
that's the second column and it keeps going like that.
137
137
00:05:16,440 --> 00:05:18,330
All right, so we're going to scroll down and locate
138
138
00:05:18,330 --> 00:05:21,990
where it says output.logstash colon.
139
139
00:05:21,990 --> 00:05:24,630
Now, in this section, I'm going to find line 111,
140
140
00:05:24,630 --> 00:05:28,020
which is the hashtag, hosts colon, and I want to change
141
141
00:05:28,020 --> 00:05:31,260
where it says localhost to my IP address of my SIEM
142
142
00:05:31,260 --> 00:05:33,750
so I can send the data from this machine over
143
143
00:05:33,750 --> 00:05:38,310
to the SIEM and that SIEM is at 10.1.0.246.
144
144
00:05:38,310 --> 00:05:42,300
So my line should now read hosts: space, space,
145
145
00:05:42,300 --> 00:05:47,300
quote, 10.1.0.246:5044, quote.
146
146
00:05:48,780 --> 00:05:51,570
And that 5044 is the port that my SIEM
147
147
00:05:51,570 --> 00:05:53,580
is configured to listen on.
148
148
00:05:53,580 --> 00:05:55,920
Now, this will allow me to get data from this,
149
149
00:05:55,920 --> 00:05:57,000
any of the log files
150
150
00:05:57,000 --> 00:05:58,650
and send it back to that SIEM,
151
151
00:05:58,650 --> 00:06:00,810
which gives me another way to collect data.
152
152
00:06:00,810 --> 00:06:02,940
So I'm going to save this and close the file
153
153
00:06:02,940 --> 00:06:05,880
and then I'm going to copy the winlogbeat folder
154
154
00:06:05,880 --> 00:06:10,290
to the C:\Program Files x86 directory.
155
155
00:06:10,290 --> 00:06:11,850
Now, I'm going to go into PowerShell
156
156
00:06:11,850 --> 00:06:14,670
and run a command to be able to start this up.
157
157
00:06:14,670 --> 00:06:16,290
So I'm going to change directories
158
158
00:06:16,290 --> 00:06:21,150
into the C:\Program Files x86/ winlogbeat directory
159
159
00:06:21,150 --> 00:06:22,410
that I just started.
160
160
00:06:22,410 --> 00:06:24,990
Then I'm going to run winlogbeat.
161
161
00:06:24,990 --> 00:06:27,510
And to do this, I'm going to use the Linux style notation.
162
162
00:06:27,510 --> 00:06:32,190
So ./winlogbeat space test space config
163
163
00:06:32,190 --> 00:06:37,190
space -c space winlogbeat.yml, space -e.
164
164
00:06:38,550 --> 00:06:41,010
And what this says is I'm going to run winlogbeat,
165
165
00:06:41,010 --> 00:06:43,860
I'm going to use it in a test in configuration mode
166
166
00:06:43,860 --> 00:06:47,400
and the configuration file is going to be winlogbeat.yml.
167
167
00:06:47,400 --> 00:06:49,110
And then I'm going to execute this.
168
168
00:06:49,110 --> 00:06:52,860
So this last part is going to say configure OK.
169
169
00:06:52,860 --> 00:06:53,970
Now, if there is an error,
170
170
00:06:53,970 --> 00:06:56,760
that means I messed up the configuration file, but if not,
171
171
00:06:56,760 --> 00:06:58,710
I'm ready to keep going.
172
172
00:06:58,710 --> 00:07:00,990
Now, at this point, I'm going to run two more commands
173
173
00:07:00,990 --> 00:07:02,340
'cause I need to install that agent
174
174
00:07:02,340 --> 00:07:03,960
as a service inside Windows
175
175
00:07:03,960 --> 00:07:06,750
so it starts up every time I reboot this computer.
176
176
00:07:06,750 --> 00:07:11,750
To do this, I'm going to do ./install-service-winlogbeat,
177
177
00:07:12,117 --> 00:07:13,710
and then I'm going to start the service
178
178
00:07:13,710 --> 00:07:17,220
by doing start-service space winlogbeat.
179
179
00:07:17,220 --> 00:07:18,780
All right, now that I have that running,
180
180
00:07:18,780 --> 00:07:20,640
I have started this up, I have configured it
181
181
00:07:20,640 --> 00:07:23,130
as a service and anytime I restart this computer,
182
182
00:07:23,130 --> 00:07:25,500
Beats is going to be running for me.
183
183
00:07:25,500 --> 00:07:27,630
So let me go back into my SIEM now
184
184
00:07:27,630 --> 00:07:32,630
and I want to run the command sudo space so-allow-view.
185
185
00:07:33,390 --> 00:07:35,190
Now, this is going to show me the output
186
186
00:07:35,190 --> 00:07:37,260
that has the firewall that's already been configured
187
187
00:07:37,260 --> 00:07:39,360
to allow the traffic from Beats
188
188
00:07:39,360 --> 00:07:42,990
over port 5044 into my SIEM.
189
189
00:07:42,990 --> 00:07:45,450
Now, if I go back into Kibana, I should again see
190
190
00:07:45,450 --> 00:07:47,820
those NIDS dashboards and those Bro notices
191
191
00:07:47,820 --> 00:07:50,280
for those scan alerts that I saw before
192
192
00:07:50,280 --> 00:07:53,970
from those scanning alerts that I caused by using Zenmap.
193
193
00:07:53,970 --> 00:07:57,270
Now, if I go under the Beats dashboard under Host Hunting,
194
194
00:07:57,270 --> 00:08:00,390
I can start seeing events from DC1 where I just started
195
195
00:08:00,390 --> 00:08:02,760
that Beats agent to send data back.
196
196
00:08:02,760 --> 00:08:03,720
Now, it may take some time
197
197
00:08:03,720 --> 00:08:06,000
for that to come in and if yours aren't there yet,
198
198
00:08:06,000 --> 00:08:08,640
you can click on update or refresh and keep checking
199
199
00:08:08,640 --> 00:08:09,473
for those alerts.
200
200
00:08:09,473 --> 00:08:11,670
Over time, they're going to start coming in
201
201
00:08:11,670 --> 00:08:14,370
and you'll see those different logs from that system.
202
202
00:08:14,370 --> 00:08:16,500
Now, the next thing I'm going to do is configure
203
203
00:08:16,500 --> 00:08:18,420
some application logging.
204
204
00:08:18,420 --> 00:08:19,560
Now, by default,
205
205
00:08:19,560 --> 00:08:22,440
Beats is going to capture the application, system
206
206
00:08:22,440 --> 00:08:25,710
and security logs when you set it up on a Windows server.
207
207
00:08:25,710 --> 00:08:27,420
Now, this is going to collect a lot of data
208
208
00:08:27,420 --> 00:08:29,520
and send a lot of it back to our SIEM and some
209
209
00:08:29,520 --> 00:08:32,220
of it may or may not be relevant for what you want to do.
210
210
00:08:32,220 --> 00:08:34,290
If you're doing incident detection or threat hunting,
211
211
00:08:34,290 --> 00:08:36,150
a lot of this just isn't something you need.
212
212
00:08:36,150 --> 00:08:37,470
If you're doing system troubleshooting,
213
213
00:08:37,470 --> 00:08:38,520
it's stuff you may need.
214
214
00:08:38,520 --> 00:08:40,350
So you need to figure that out inside your organization
215
215
00:08:40,350 --> 00:08:43,020
and determine what you want to log and how much.
216
216
00:08:43,020 --> 00:08:45,210
So let's say we want to configure our application log.
217
217
00:08:45,210 --> 00:08:47,580
So we're starting to send data to the SIEM.
218
218
00:08:47,580 --> 00:08:49,020
Well, let's go over to MS1,
219
219
00:08:49,020 --> 00:08:51,300
which was my IIS server machine.
220
220
00:08:51,300 --> 00:08:52,590
And I want to go in there and look
221
221
00:08:52,590 --> 00:08:54,930
at the access logs from the event viewer
222
222
00:08:54,930 --> 00:08:57,180
and then have Beats forward that to the SIEM.
223
223
00:08:57,180 --> 00:09:00,180
That way I can get data about my web server.
224
224
00:09:00,180 --> 00:09:02,970
So let me go ahead and go into MS1.
225
225
00:09:02,970 --> 00:09:05,490
And from here, I'm going to go under Server Manager,
226
226
00:09:05,490 --> 00:09:08,430
select tools and then Internet Information Services
227
227
00:09:08,430 --> 00:09:10,680
or IIS Manager.
228
228
00:09:10,680 --> 00:09:12,210
Inside the IIS Manager,
229
229
00:09:12,210 --> 00:09:14,310
I'm going to select the server MS1
230
230
00:09:14,310 --> 00:09:15,240
and I'm going to double click
231
231
00:09:15,240 --> 00:09:17,970
on the logging app in the middle pane.
232
232
00:09:17,970 --> 00:09:19,920
This will show me the different options I have
233
233
00:09:19,920 --> 00:09:21,480
for log formats.
234
234
00:09:21,480 --> 00:09:23,760
Now, if you remember from our log formatting lesson,
235
235
00:09:23,760 --> 00:09:24,930
you're going to see that there's lots
236
236
00:09:24,930 --> 00:09:26,220
of different formats you can use
237
237
00:09:26,220 --> 00:09:28,680
but I'm going to use the standard of W3C,
238
238
00:09:28,680 --> 00:09:31,620
which is really good for web application logs.
239
239
00:09:31,620 --> 00:09:34,380
Now, under the log event destination, I can select
240
240
00:09:34,380 --> 00:09:38,610
both the log file and an ETW event and click apply.
241
241
00:09:38,610 --> 00:09:40,140
This means I'm going to log it locally
242
242
00:09:40,140 --> 00:09:42,150
to the computer and I'm going to send it
243
243
00:09:42,150 --> 00:09:45,540
as this type of event over through Beats.
244
244
00:09:45,540 --> 00:09:48,870
Now, if I go to Explorer, I can copy the winlogbeat
245
245
00:09:48,870 --> 00:09:51,360
from my domain controller that I installed it on before
246
246
00:09:51,360 --> 00:09:55,440
to the local system here with MS1, my web server.
247
247
00:09:55,440 --> 00:09:58,200
I'm then going to go into PowerShell as an administrator
248
248
00:09:58,200 --> 00:10:01,680
and I need to run this big, long, scary command.
249
249
00:10:01,680 --> 00:10:02,700
Now, again, this is something you don't have
250
250
00:10:02,700 --> 00:10:03,761
to memorize for the exam
251
251
00:10:03,761 --> 00:10:06,690
but it is what we need to run to be able to check the name
252
252
00:10:06,690 --> 00:10:10,170
of the event log that's capturing those IIS events.
253
253
00:10:10,170 --> 00:10:13,410
So I'm going to do get-winevent space
254
254
00:10:13,410 --> 00:10:17,340
dash listlog space, star space
255
255
00:10:17,340 --> 00:10:21,690
pipe space wear-object space, curly bracket,
256
256
00:10:21,690 --> 00:10:26,170
space dollar sign underscore .logname space -like
257
257
00:10:27,240 --> 00:10:32,240
space quote *IIS, quote *IIS* star quote,
258
258
00:10:33,360 --> 00:10:38,070
curly bracket, space pipe space format -list
259
259
00:10:38,070 --> 00:10:42,000
space -property space logname.
260
260
00:10:42,000 --> 00:10:43,350
Woo, that was a long one.
261
261
00:10:43,350 --> 00:10:44,610
So what is this saying?
262
262
00:10:44,610 --> 00:10:45,780
Well, I want to get all
263
263
00:10:45,780 --> 00:10:48,690
of the Windows events that meet these conditions.
264
264
00:10:48,690 --> 00:10:51,090
If it's listing the logs that have a star,
265
265
00:10:51,090 --> 00:10:53,610
meaning anything, I want to grab those
266
266
00:10:53,610 --> 00:10:56,070
or I want to grab things where there's an object
267
267
00:10:56,070 --> 00:10:57,780
where the logname has something
268
268
00:10:57,780 --> 00:11:01,740
like IIS in it or I want to get anything that's formatted
269
269
00:11:01,740 --> 00:11:04,380
as a list with the property of logname.
270
270
00:11:04,380 --> 00:11:07,320
So if I take all those things, I can gather those events
271
271
00:11:07,320 --> 00:11:08,880
and then I can figure out what I want.
272
272
00:11:08,880 --> 00:11:11,340
This query is going to match a couple of logs,
273
273
00:11:11,340 --> 00:11:12,690
in fact, three of them.
274
274
00:11:12,690 --> 00:11:14,190
And then I want to copy the text
275
275
00:11:14,190 --> 00:11:18,390
Microsoft-IIS-Logging/Logs
276
276
00:11:18,390 --> 00:11:20,310
and copy the value from the prompt,
277
277
00:11:20,310 --> 00:11:22,113
select it and press enter.
278
278
00:11:23,010 --> 00:11:25,830
Now, I'm going to open up the Program Files directory
279
279
00:11:25,830 --> 00:11:27,900
under winlogbeat that I just installed
280
280
00:11:27,900 --> 00:11:29,970
and find that configuration file.
281
281
00:11:29,970 --> 00:11:31,770
I want to go ahead into that file
282
282
00:11:31,770 --> 00:11:36,000
and under the winlogbeat-event_logs, colon,
283
283
00:11:36,000 --> 00:11:38,280
I want to add the text that says
284
284
00:11:38,280 --> 00:11:43,280
name: Microsoft-IIS-Logging/Logs.
285
285
00:11:44,070 --> 00:11:46,260
All right, now that I have this file configured
286
286
00:11:46,260 --> 00:11:47,093
the way I want,
287
287
00:11:47,093 --> 00:11:49,470
I'm going to close it and say yes to save it.
288
288
00:11:49,470 --> 00:11:50,760
And then I'm going to go back
289
289
00:11:50,760 --> 00:11:54,240
into my administrator mode and go into my PowerShell prompt.
290
290
00:11:54,240 --> 00:11:56,010
I now want to run the command to get
291
291
00:11:56,010 --> 00:11:57,840
into the directory for winlogbeat,
292
292
00:11:57,840 --> 00:12:02,840
which is cd space C:\Program Files /winlogbeat.
293
293
00:12:03,570 --> 00:12:06,900
And then I want to run the configuration file and load it up.
294
294
00:12:06,900 --> 00:12:07,733
So just like I did
295
295
00:12:07,733 --> 00:12:10,800
on the domain controller, ./ winlogbeat
296
296
00:12:10,800 --> 00:12:15,800
test config -c winlogbeat.yml -e.
297
297
00:12:16,260 --> 00:12:17,940
Now, if I got that last part right,
298
298
00:12:17,940 --> 00:12:20,880
I'm going to see output that says config OK.
299
299
00:12:20,880 --> 00:12:22,920
This means I'm ready to move on.
300
300
00:12:22,920 --> 00:12:25,260
Now, I need to start it up as a service just like I did
301
301
00:12:25,260 --> 00:12:26,637
on the domain controller.
302
302
00:12:26,637 --> 00:12:31,470
./install-service-winlogbeat, hit enter
303
303
00:12:31,470 --> 00:12:35,940
and then start-service space winlogbeat and hit enter.
304
304
00:12:35,940 --> 00:12:38,940
Now, we have winlogbeat or Beats running
305
305
00:12:38,940 --> 00:12:41,523
on both the domain controller and the web server.
306
306
00:12:42,390 --> 00:12:44,760
Now, I want to be able to start generating some traffic here.
307
307
00:12:44,760 --> 00:12:46,647
So I'm going to go over to my PC1
308
308
00:12:46,647 --> 00:12:50,010
and my PC2 and I'm going to do some things like going
309
309
00:12:50,010 --> 00:12:53,409
and accessing share drives or browsing to different websites
310
310
00:12:53,409 --> 00:12:56,100
or using Zenmap to start scanning some things.
311
311
00:12:56,100 --> 00:12:57,030
And when I do this,
312
312
00:12:57,030 --> 00:12:59,970
this is going to generate some traffic for this lab environment
313
313
00:12:59,970 --> 00:13:02,670
and it should generate both network traffic that's captured
314
314
00:13:02,670 --> 00:13:05,070
by the SIEM based on that port mirroring
315
315
00:13:05,070 --> 00:13:07,890
and it's going to capture application logs and event logs
316
316
00:13:07,890 --> 00:13:10,533
from the domain controller and from the web server.
317
317
00:13:11,610 --> 00:13:13,830
All right, the next thing I want to do is install
318
318
00:13:13,830 --> 00:13:16,380
a host-based intrusion detection system.
319
319
00:13:16,380 --> 00:13:17,213
And I'm going to do this
320
320
00:13:17,213 --> 00:13:19,830
by using an agent on one of these clients.
321
321
00:13:19,830 --> 00:13:23,250
So with the Windows clients, we are going to install OSSEC,
322
322
00:13:23,250 --> 00:13:24,960
which is a HIDS agent.
323
323
00:13:24,960 --> 00:13:25,890
Now, this is going to produce
324
324
00:13:25,890 --> 00:13:27,840
only security-relevant information for us
325
325
00:13:27,840 --> 00:13:29,670
and again, we want to configure that
326
326
00:13:29,670 --> 00:13:32,130
to send that data back to our SIEM.
327
327
00:13:32,130 --> 00:13:35,610
So I'm going to go into PC1 and I'm going to go ahead
328
328
00:13:35,610 --> 00:13:40,410
and run this program called Wazuh, which is W-A-Z-U-H.
329
329
00:13:40,410 --> 00:13:41,243
To run it,
330
330
00:13:41,243 --> 00:13:42,984
I'm going to go into my lab files directory,
331
331
00:13:42,984 --> 00:13:47,640
/wazuh-agent- the version number .msi.
332
332
00:13:47,640 --> 00:13:49,410
This will start my installer.
333
333
00:13:49,410 --> 00:13:51,540
I'm going to go through this installer pretty basically
334
334
00:13:51,540 --> 00:13:53,550
and I'm going to accept and install it.
335
335
00:13:53,550 --> 00:13:55,050
And when this setup is completed,
336
336
00:13:55,050 --> 00:13:58,140
I'm going to click run agent configuration interface
337
337
00:13:58,140 --> 00:13:59,640
and then click finish.
338
338
00:13:59,640 --> 00:14:00,990
If I get a UAC prompt,
339
339
00:14:00,990 --> 00:14:03,960
I'm going to go ahead and approve it and say yes.
340
340
00:14:03,960 --> 00:14:06,510
Now, the next thing I want to do is open a command prompt
341
341
00:14:06,510 --> 00:14:11,490
as the administrator and C:\Program Files x86
342
342
00:14:11,490 --> 00:14:16,490
\ossec-agent\ahent-auth.exe -m 10.1.0.246
343
343
00:14:20,730 --> 00:14:23,340
Remember, that's the IP address of my server.
344
344
00:14:23,340 --> 00:14:25,050
So where am I sending these things?
345
345
00:14:25,050 --> 00:14:27,540
I'm going to send 'em back to that same server.
346
346
00:14:27,540 --> 00:14:29,430
All right, now that we've done that,
347
347
00:14:29,430 --> 00:14:30,960
we've associated this agent
348
348
00:14:30,960 --> 00:14:33,000
with the manager that's running on the SIEM.
349
349
00:14:33,000 --> 00:14:34,920
That's what that -m is for.
350
350
00:14:34,920 --> 00:14:36,450
Now, this will make sure there's a connection
351
351
00:14:36,450 --> 00:14:39,060
between the two so I can send the data there.
352
352
00:14:39,060 --> 00:14:41,850
Now, if I switch back to the Wazuh Agent Manager dialog,
353
353
00:14:41,850 --> 00:14:43,500
I can click the refresh button
354
354
00:14:43,500 --> 00:14:45,360
and I should see a key that's loaded
355
355
00:14:45,360 --> 00:14:47,150
in the authentication key box.
356
356
00:14:47,150 --> 00:14:48,990
If I go to the manager IP box,
357
357
00:14:48,990 --> 00:14:51,917
I can type in my manager's IP address, that of the SIEM.
358
358
00:14:51,917 --> 00:14:55,890
10.1.0.246.
359
359
00:14:55,890 --> 00:14:56,723
Once I do that,
360
360
00:14:56,723 --> 00:15:01,723
I'm going to save it and then select Manage, Start and OK.
361
361
00:15:01,740 --> 00:15:03,750
Now, if I wanted to do this on the other PCs
362
362
00:15:03,750 --> 00:15:05,790
in my network, I would do the exact same thing
363
363
00:15:05,790 --> 00:15:08,400
and configure all of them the same way and that way all
364
364
00:15:08,400 --> 00:15:11,013
of my devices can go back and reach to that SIEM.
365
365
00:15:11,910 --> 00:15:14,220
All right, now that we've done that, let's go back
366
366
00:15:14,220 --> 00:15:16,620
into our SIEM and start looking at some data.
367
367
00:15:16,620 --> 00:15:18,210
We want to start extracting data
368
368
00:15:18,210 --> 00:15:20,160
and aggregating these records to make use
369
369
00:15:20,160 --> 00:15:22,680
of our SIEM and understand what's in there.
370
370
00:15:22,680 --> 00:15:26,400
So inside my SIEM, I'm going to go under the OSSEC dashboard
371
371
00:15:26,400 --> 00:15:27,960
under Host Hunting.
372
372
00:15:27,960 --> 00:15:29,550
Here I'm going to use the update
373
373
00:15:29,550 --> 00:15:32,370
or refresh to check for any new alerts.
374
374
00:15:32,370 --> 00:15:35,040
Now, once I do that, I'm going to click the management tab
375
375
00:15:35,040 --> 00:15:39,480
and select index patterns and then create index pattern.
376
376
00:15:39,480 --> 00:15:41,280
Now, in the index pattern box,
377
377
00:15:41,280 --> 00:15:43,197
I want to type log-ossec-*
378
378
00:15:46,050 --> 00:15:47,940
and then click next step.
379
379
00:15:47,940 --> 00:15:50,370
This is the pattern I'm identifying.
380
380
00:15:50,370 --> 00:15:53,760
Then from the time filter, I can select I don't want
381
381
00:15:53,760 --> 00:15:56,220
to use a time filter 'cause I want everything to show up
382
382
00:15:56,220 --> 00:15:58,350
or I might just want to look at today's stuff
383
383
00:15:58,350 --> 00:16:01,410
or the last three hour stuff or a certain time period based
384
384
00:16:01,410 --> 00:16:04,560
on what we saw from some kind of a malicious event.
385
385
00:16:04,560 --> 00:16:06,030
Now, once I've done that,
386
386
00:16:06,030 --> 00:16:08,130
I can click the create index pattern button
387
387
00:16:08,130 --> 00:16:09,930
and this creates my pattern.
388
388
00:16:09,930 --> 00:16:12,330
From here, I can click the discovery tab.
389
389
00:16:12,330 --> 00:16:13,680
Now, from the list box,
390
390
00:16:13,680 --> 00:16:17,790
I want to select log-ossec-*,
391
391
00:16:17,790 --> 00:16:20,190
which is the index pattern that I just created.
392
392
00:16:20,190 --> 00:16:23,520
Now, under my search box, I want to create a filter string
393
393
00:16:23,520 --> 00:16:24,540
and then I'm going to update it.
394
394
00:16:24,540 --> 00:16:28,983
So I'm going to do this by typing in agent.name: PC*
395
395
00:16:29,820 --> 00:16:34,820
AND alert_level colon: greater than or equal to five.
396
396
00:16:35,010 --> 00:16:37,830
What this says is anytime you found an agent
397
397
00:16:37,830 --> 00:16:39,450
that was PC something
398
398
00:16:39,450 --> 00:16:41,850
in my network, PC1 or PC2,
399
399
00:16:41,850 --> 00:16:44,730
and the alert level was greater than or equal to five,
400
400
00:16:44,730 --> 00:16:46,380
I want you to display it.
401
401
00:16:46,380 --> 00:16:49,380
Now, as I look at these results, I can see some results here
402
402
00:16:49,380 --> 00:16:52,080
and I can click the small black arrow to expand the record
403
403
00:16:52,080 --> 00:16:54,420
and view all of the different event data around it.
404
404
00:16:54,420 --> 00:16:56,010
And so you can see pretty quickly here
405
405
00:16:56,010 --> 00:16:58,110
how we can start slicing and dicing data
406
406
00:16:58,110 --> 00:17:00,300
and searching for things on a particular machine,
407
407
00:17:00,300 --> 00:17:03,450
such as PC1 or PC2, or if you wanted to look
408
408
00:17:03,450 --> 00:17:05,880
at all machines by using wildcard characters
409
409
00:17:05,880 --> 00:17:06,720
and then identifying
410
410
00:17:06,720 --> 00:17:08,970
what looks malicious across your network.
411
411
00:17:08,970 --> 00:17:10,890
The great thing about a SIEM is I'm not looking
412
412
00:17:10,890 --> 00:17:12,780
at everything as individual pieces.
413
413
00:17:12,780 --> 00:17:15,120
All that data is in one place, so I can see it
414
414
00:17:15,120 --> 00:17:18,360
across the entire network and start looking for patterns.
415
415
00:17:18,360 --> 00:17:21,120
Next, let's configure a syslog source.
416
416
00:17:21,120 --> 00:17:22,830
Now, this is important because a lot
417
417
00:17:22,830 --> 00:17:24,090
of hosts you're going to deal with
418
418
00:17:24,090 --> 00:17:26,340
may not have the ability to install an agent
419
419
00:17:26,340 --> 00:17:28,620
but most things can be configured
420
420
00:17:28,620 --> 00:17:30,480
for remote syslog monitoring.
421
421
00:17:30,480 --> 00:17:32,460
So to do this, I'm going to go ahead
422
422
00:17:32,460 --> 00:17:35,070
and do that on my pfSense security appliance,
423
423
00:17:35,070 --> 00:17:37,680
which is my unified threat management system.
424
424
00:17:37,680 --> 00:17:40,470
So when I go into that unified threat management system,
425
425
00:17:40,470 --> 00:17:43,200
I can click on status and system logs
426
426
00:17:43,200 --> 00:17:45,630
and then click on the Settings tab.
427
427
00:17:45,630 --> 00:17:47,040
Here, if I scroll down,
428
428
00:17:47,040 --> 00:17:49,680
I'll find the option for remote logging.
429
429
00:17:49,680 --> 00:17:52,770
When I click that, I can enable remote logging.
430
430
00:17:52,770 --> 00:17:57,770
Then I can type in my server name, 10.1.0.246
431
431
00:17:57,870 --> 00:17:58,703
and I'm going to put that
432
432
00:17:58,703 --> 00:18:03,180
on port 514 because that is the port for syslog.
433
433
00:18:03,180 --> 00:18:05,850
Now, from the remote syslog contents,
434
434
00:18:05,850 --> 00:18:07,620
I can check the system events
435
435
00:18:07,620 --> 00:18:10,380
and the firewall events because those are the ones I want.
436
436
00:18:10,380 --> 00:18:12,240
And then I'll click save.
437
437
00:18:12,240 --> 00:18:13,080
Now, if I go back
438
438
00:18:13,080 --> 00:18:15,930
into my SIEM and I go back into Kibana, I can click
439
439
00:18:15,930 --> 00:18:18,780
on the management tab and then select index patterns
440
440
00:18:18,780 --> 00:18:21,630
and then we can create a new index pattern.
441
441
00:18:21,630 --> 00:18:26,630
So in this index pattern, I'm going to call it log-syslog-star
442
442
00:18:27,030 --> 00:18:28,650
and click Next step.
443
443
00:18:28,650 --> 00:18:29,730
For the time filter,
444
444
00:18:29,730 --> 00:18:32,100
again, I don't want to use the time filter
445
445
00:18:32,100 --> 00:18:34,620
and then click create index pattern.
446
446
00:18:34,620 --> 00:18:36,390
If I go to the discovery tab,
447
447
00:18:36,390 --> 00:18:41,010
here I can find logstash-syslog-*.
448
448
00:18:41,010 --> 00:18:43,020
Now, if I search for something, for instance,
449
449
00:18:43,020 --> 00:18:48,020
syslog-sourceip: 10.1.0.254,
450
450
00:18:48,090 --> 00:18:51,420
and then hit update, I can find all of the syslog things
451
451
00:18:51,420 --> 00:18:54,120
that are associated with that IP address.
452
452
00:18:54,120 --> 00:18:56,970
So at this point, we have looked at some different options
453
453
00:18:56,970 --> 00:18:59,430
for taking information into our SIEM.
454
454
00:18:59,430 --> 00:19:02,280
We can do it based on traffic sources, by a network tap,
455
455
00:19:02,280 --> 00:19:04,200
we can use agents like Beats
456
456
00:19:04,200 --> 00:19:07,080
and we can use syslog for our more generic systems
457
457
00:19:07,080 --> 00:19:09,090
that don't have Beats installed.
458
458
00:19:09,090 --> 00:19:12,360
Now, once we've done all that, we might have a lot
459
459
00:19:12,360 --> 00:19:14,610
of log data coming in, so it'll be important for us
460
460
00:19:14,610 --> 00:19:17,250
to define our use cases and tune our sensors
461
461
00:19:17,250 --> 00:19:20,280
and tune our logging to exactly what we're looking for.
462
462
00:19:20,280 --> 00:19:22,950
But this lab should have given you a great introduction
463
463
00:19:22,950 --> 00:19:25,440
to Security Onion and how to set up these different things
464
464
00:19:25,440 --> 00:19:26,880
on your network.
465
465
00:19:26,880 --> 00:19:29,580
Again, like all the tools we've talked about in this course,
466
466
00:19:29,580 --> 00:19:31,290
I do recommend downloading this
467
467
00:19:31,290 --> 00:19:34,410
onto a virtual machine in your network, set up an appliance
468
468
00:19:34,410 --> 00:19:36,510
and then start capturing your own network traffic
469
469
00:19:36,510 --> 00:19:38,310
and see what patterns you can identify.
470
470
00:19:38,310 --> 00:19:39,900
Learn how to read these logs
471
471
00:19:39,900 --> 00:19:41,550
and learn how to use these tools.
472
472
00:19:41,550 --> 00:19:43,740
It'll make you a much better cybersecurity analyst
473
473
00:19:43,740 --> 00:19:45,780
and it'll help you pass your job interviews
474
474
00:19:45,780 --> 00:19:47,250
because employers are going to want to know
475
475
00:19:47,250 --> 00:19:49,800
that you know how to use a SIEM and how to read it.